php - 您的 SQL 语法 Mysql 有错误

Question

我的 sql 查询是：

"INSERT INTO
    order customer_id = $customer_id
    , firstname = '".$firstname."'
    , lastname = '".$lastname."'
    , email = '".$email."'
    , telephone = '".$telephone."'
    , fax = '".$fax."'
    , ip = '".$ip."'
    , date_added = NOW()
    , date_modified = NOW()
";

我得到错误

注意：错误：您的 SQL 语法有错误；检查与您的 MySQL 服务器版本相对应的手册，以在第 1 行的 'order customer_id =1,firstname ='kuldeep',lastname ='pathak',email ='kuldeep.pat' 附近使用正确的语法错误编号：1064

Answer 1

您似乎并不了解如何编写 SQL。

$sql = 'INSERT INTO `order` (customer_id, firstname, blablabla) VALUES ('.$custormer_id.','.$firstname.','.$blablabla.')';

请看一些关于 SQL 的基础教程。

Answer 2

"INSERT INTO
    `order` SET customer_id = " . $customer_id . "
    , firstname = '".$firstname."'
    , lastname = '".$lastname."'
    , email = '".$email."'
    , telephone = '".$telephone."'
    , fax = '".$fax."'
    , ip = '".$ip."'
    , date_added = NOW()
    , date_modified = NOW()
";

应该没问题。不要忘记转义您的数据。

Answer 3

使用准备好的语句来避免 sql 注入。

$custormer_id = "2000";
$firstname = "first name";
$etc = "some other values";
$mysqli = new mysqli('localhost', 'user', 'password', 'database');
$stmt = $mysqli->prepare("INSERT INTO order(customer_id, firstname, etc) VALUES (?, ?, ?)");
$stmt->bind_param('iss', $custormer_id, $firstname, $etc);
// first parameter is corresponding variable type of inserting values,eg i=interger, s=string
$stmt->execute();
$stmt->close();

http://php.net/manual/en/mysqli-stmt.bind-param.php

Answer 4

尝试

"INSERT INTO `Order` (customer_id, firstname, lastname, email, telephone, fax, ip, date_added, date_modified)
VALUES ($customer_id, '$firstname', '$lastname', '$email', '$telephone', '$fax', '$ip', NOW(), NOW())"

正确的语法是：INSERT INTO tablename (columns) VALUES (values);

Answer 5

如果您可能在数据集中有用户提交的字段或撇号或其他任何可能由于任何原因导致问题的内容，您会想要更多类似的东西

$query = sprintf("INSERT INTO `table` (`Name`, `Email`, `AnotherField`) VALUES ('%s', '%s', '%s'",
mysql_real_escape_string( $_POST['Name'] ),
mysql_real_escape_string( $_POST['Email'] ),
mysql_real_escape_string( $_POST['AnotherField'] )
);

这也将清理您的输入